Hello, I’m on windows and I’m trying to run a themida dumper that kills all processes with the names “python.exe” & “pythonw.exe”.
I don’t want to rename the executable or have some rename-executable block at the top of my script since my program is a extractor for a lot of formats and I don’t want to have that block run just for any format because that just feels kinda.. eh…
I’ve already tried around a bit with ctypes.windll.advapi32 but none of that worked.
My other idea was to move my entire scope (including call stack and that sort of thing) but haven’t found a way to do that as pickle doesn’t like frames and I can’t just move the entire memory because of absolute addresses.
Here’s a test script:
import os
import time
os.system('start "" themida_dumper_x64.exe themida_dumper_x64.exe --no-pause')
time.sleep(60)
and here’s the dumper:
I didn’t include a prebuilt executable since I don’t know if that’s allowed here or not.